VA won’t require existing FedRAMP certification for cloud contracts, memo reveals

Existing FedRAMP certification is not required for Department of Veterans Affairs contractors to win bids, a top agency IT official said Tuesday in a memo obtained by FedScoop.

Any acquisition documents, including requests for information, proposals or quotations, should not state or imply that a cloud company must have already completed the governmentwide security check, Zack Schwartz, principal deputy assistant secretary in the VA’s Office of Information and Technology, said in the memo.

“This memo supports VA’s ability to sustain momentum with mission needs to provide secure technology solutions in a dynamic cyber risk environment, while avoiding unnecessary delays in the procurement of critical systems and services,” he wrote. 

“This distinction is intended to preserve acquisition flexibility while maintaining VA’s risk management and operational security standards,” he added later in the document.

Instead, cloud systems, services and solutions companies must fully comply with other security requirements — including those from the National Institute of Standards and Technology, VA directives and handbooks — and receive a VA Authorization to Operate, which could be granted in 60 days.

“As the Federal cloud authorization environment continues to evolve, VA policy and implementation expectations will continue to be updated to ensure continued access to high-quality cloud capabilities and to support the timely and secure delivery of services to Veterans,” Schwartz said in the memo.

A VA spokesperson told FedScoop that the change “is a significant step forward for Veterans and for innovation at VA.”

“By removing unnecessary barriers to competition while maintaining our rigorous security and authorization standards, we’re expanding access to the best commercial technologies, accelerating delivery of modern digital services and ensuring we continue to protect Veterans’ data,” they said.

The memo said post-contract award cloud service providers should be prepared to provide security and privacy-related documentation to receive a determination for operating within VA’s environment, which could include vulnerability scans and any possible implementation status of FedRAMP 20x key security indicators.

“This memo does not waive, defer, or diminish any otherwise applicable VA security, privacy, or authorization requirements,” Schwartz wrote. “Before any cloud system/service may go into operation, it must still comply with all applicable VA policies and security authorization requirements, regardless of whether it has Fed RAMP certification at the time of procurement.”

Previously, Schwartz told FedScoop that as “the largest customer for nearly all of our technology vendors,” the VA is setting new standards for contractors. 

“People are seeing how fast we are changing how we contract, how we change our expectations for those contractors and how we hold not only contractors but the federal team accountable to achieve an outcome,” he said.

Billy Mitchell contributed to this report.